Evict CE key on request and when work mode is turned off.

DPMS.lockNow takes a flag which can request the managed profile CE key to
be evicted.

Test: com.android.cts.devicepolicy.ManagedProfileTest#testLockNowWithKeyEviction*
Bug: 31000719
Change-Id: I68f4d6eed4b041c39fd13375f7f284f5d6ac33da